{"id":"CVE-2026-126151","kind":"vulnerability","aliases":["CVE-2026-126151"],"related":[],"title":"Fortinet FortiMail: flawed authentication lets remote attackers take over accounts","description":"A incorrect implementation of authentication algorithm vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated remote attacker to gain elevation of privilege (account takeover) via a crafted request.","summary":"FortiMail mail appliances implement an authentication algorithm incorrectly. An unauthenticated remote attacker can send a crafted request to gain elevated privileges and take over accounts.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiMail","fixed":["8.0.2","7.6.7","7.4.9"],"affected":">= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.6; >= 7.4.0, <= 7.4.8; 7.2 all versions","ecosystem":"vendor"}],"ecosystems":[],"tags":["email-security","fortimail","fortinet","infrastructure","self-hosted"],"not_affected_if":["fortimail-cloud","version-outside-listed-ranges"],"how_to_check":"Check the FortiMail version in the admin interface or with 'get system status'. Exposed if it is 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, or any 7.2. FortiMail Cloud needs no action.","fix":"Upgrade FortiMail to 8.0.2 or above (8.0.x), 7.6.7 or above (7.6.x), 7.4.9 or above (7.4.x). FortiMail 7.2 has no fixed 7.2 release: migrate to a fixed release (7.4.9+ / 7.6.7+ / 8.0.2+).","status":"open","published_at":"2026-11-11T22:17:12+00:00","first_seen_at":"2026-11-11T22:29:28+00:00","triaged_at":"2026-11-11T22:33:04+00:00","updated_at":"2026-11-11T22:48:46+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-11T22:33:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Fortinet FortiMail: flawed authentication lets remote attackers take over accounts","impact":"high","summary":"FortiMail mail appliances implement an authentication algorithm incorrectly. An unauthenticated remote attacker can send a crafted request to gain elevated privileges and take over accounts.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortimail","fortinet","email-security","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker takes over accounts and gains elevated privileges on the appliance","analyst_note":"Find the Fortinet PSIRT advisory for CVE-2026-126151 to confirm the fixed versions and any affected configuration; the NVD entry gives only the ranges.","how_to_check":"- Check the FortiMail version in the admin interface or with `get system status` on the appliance.\n- Compare the running version against the affected ranges: 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all of 7.2.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-outside-listed-ranges"],"who_is_affected":"Organizations running FortiMail appliances in the affected version ranges, reachable from the network the attacker can reach. The sources do not say whether the flaw needs a specific configuration, so the affected ranges are the main signal. Teams on versions outside the listed ranges can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000751,"input_tokens":4601,"output_tokens":581,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Fortinet PSIRT advisory for CVE-2026-126151 to confirm the fixed versions and any affected configuration; the NVD entry gives only the ranges.","search":"'-126151':13A,16A '-2026':12A,15A '7.2':74C '7.4.0':70C '7.4.8':72C '7.6.0':66C '7.6.6':68C '8.0.0':62C '8.0.1':64C 'account':10A,51B,88C 'algorithm':33B,57C 'allow':78C 'applianc':29B 'attack':7A,38B,82C 'authent':4A,32B,56C 'craft':42B,92C 'cve':11A,14A 'elev':46B,85C 'email':19B 'email-secur':18B 'flaw':3A 'fortimail':2A,17A,21B,27B,61C,65C,69C,73C 'fortinet':1A,22B,60C 'gain':45B,84C 'host':26B 'implement':30B,54C 'incorrect':34B,53C 'infrastructur':23B 'let':5A 'mail':28B 'may':77C 'privileg':47B,87C 'remot':6A,37B,81C 'request':43B,93C 'secur':20B 'self':25B 'self-host':24B 'send':40B 'take':8A,49B 'takeov':89C 'unauthent':36B,80C 'version':76C 'via':90C 'vulner':58C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted FortiMail appliances or VMs on 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8 or any 7.2 release. Fortinet says an unauthenticated remote attacker could take over accounts with a crafted request; the advisory names no required configuration. FortiMail Cloud was updated by Fortinet on Oct 05, 2026 and customers need not act.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:48:46Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-203","run_id":3665},"products":{"at":"2026-11-11T22:48:46Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-203","run_id":3665},"who_affected":{"at":"2026-11-11T22:48:46Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-203","run_id":3665}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["fortimail"],"ptokens":["fortimail"],"labels":["emailsecurity","fortimail","fortinet","high","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-126151':13A,16A '-2026':12A,15A 'account':10A 'attack':7A 'authent':4A 'cve':11A,14A 'flaw':3A 'fortimail':2A,17A 'fortinet':1A 'let':5A 'remot':6A 'take':8A","search_b":"'account':51B 'algorithm':33B 'applianc':29B 'attack':38B 'authent':32B 'craft':42B 'elev':46B 'email':19B 'email-secur':18B 'fortimail':21B,27B 'fortinet':22B 'gain':45B 'host':26B 'implement':30B 'incorrect':34B 'infrastructur':23B 'mail':28B 'privileg':47B 'remot':37B 'request':43B 'secur':20B 'self':25B 'self-host':24B 'send':40B 'take':49B 'unauthent':36B","search_c":"'7.2':74C '7.4.0':70C '7.4.8':72C '7.6.0':66C '7.6.6':68C '8.0.0':62C '8.0.1':64C 'account':88C 'algorithm':57C 'allow':78C 'attack':82C 'authent':56C 'craft':92C 'elev':85C 'fortimail':61C,65C,69C,73C 'fortinet':60C 'gain':84C 'implement':54C 'incorrect':53C 'may':77C 'privileg':87C 'remot':81C 'request':93C 'takeov':89C 'unauthent':80C 'version':76C 'via':90C 'vulner':58C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126151","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126151","severity":null,"published_at":"2026-11-11T22:17:12+00:00","modified_at":"2026-11-11T22:17:12+00:00","first_seen_at":"2026-11-11T22:29:28+00:00","fetched_at":"2026-11-11T22:29:28+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126151:3665","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-203","severity":null,"published_at":"2026-11-11T22:48:46+00:00","modified_at":"2026-11-11T22:48:46+00:00","first_seen_at":"2026-11-11T22:48:46+00:00","fetched_at":"2026-11-11T22:48:46+00:00","note":"Read Fortinet PSIRT FG-IR-26-203: fixed versions confirmed, not exploited per vendor, no virtual patch. Advisory page's title/summary says 'FortiWeb' (apparent typo) but its table and CVE ID are FortiMail. Page lists impact as 'Denial of service' while summary says account takeover; left as the summary states. NVD CVSS 7.5 vector is confidentiality-only. No posts searched (new, low profile).","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-203"]}],"documents":[{"id":129724,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-203","title":"Fortinet PSIRT FG-IR-26-203 (CVE-2026-126151)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}